UNSECURITY Episode 129: Open Discussion with Ron Woerner on RSA, Bellvue, and Social Engineering

### Overview In Episode 129 of the UNSECURITY podcast, hosts Evan Francen and Brad Nigh host cybersecurity professor, consultant, and frequent RSA Conference speaker Ron Woerner. The discussion centers on social engineering dynamics, personal and professional cybersecurity hygiene, public awareness, teaching methodologies, and the legal and ethical gray areas encountered during security testing.

### Key Topics - **Social Engineering and Influence**: Woerner and the hosts discuss the mechanics of social engineering, highlighting Robert Cialdini's principles of influence (such as likability, authority, commitment, and scarcity). They examine attack vectors ranging from romance scams and business email compromise (BEC) to web conference chat link dropping (termed "wishing") and in-person rapport building at conferences. - **Situational Awareness vs. Human Nature**: The hosts and guest explore why people fall for scams, noting the tendency to prioritize convenience over security (e.g., leaving Wi-Fi auto-connect enabled). They emphasize the importance of situational awareness, shifting from "fast brain" reactive decisions to deliberate "slow brain" evaluation, and cultivating approachable security teams so users feel comfortable reporting suspicious activities. - **Education, Mentorship, and Cyber Hygiene**: Woerner discusses his role at Bellevue University, running cybersecurity curricula, and the need to demystify security for general audiences and youth (including his TEDx talk "Hackers Wanted"). The participants discuss how security professionals can earn CPE credits by educating local communities and schools on basic security hygiene, password management, and multi-factor authentication.

### Technical Details - **Public Wi-Fi Vulnerabilities**: Public Wi-Fi risks are examined, particularly how devices automatically reconnect based strictly on SSID matching, opening avenues for rogue access points (such as the Wi-Fi Pineapple). Woerner also shares a personal anecdote of encountering an auditorium projector with default credentials (`admin`/blank or `admin`), underscoring persistent default configurations. - **Physical and Authorization Boundaries**: Evan recounts an authorized physical penetration test involving dumpster diving with an engagement letter where a false identity was provided to responding law enforcement, highlighting how authorization nuances and scope planning are critical to avoiding legal conflicts. - **Defensive Tactics**: Discussion includes using reputable VPNs to encrypt traffic on untrusted networks, turning off auto-connect settings on mobile devices, employing password managers, utilizing biometrics properly (storing minutiae rather than raw biometric images), and maintaining segmented backups.

### Takeaways - Focus on core security hygiene fundamentals (patch management, backups, MFA, and strong credential practices) before pursuing esoteric defenses. - Security awareness programs should avoid user-shaming and instead provide simple, actionable alternatives (analogous to "Eat This, Not That"). - Foster an environment of "if you see something, say something" by pausing to evaluate unexpected requests and verifying communications through secondary, out-of-band channels.